IEEE TNS/NSREC 1997 


/A/ 


_? : ' V ’ / 

Radiation Effects on Current Field Programmable Technologies 


R. Katz , K. LaBel , J.J. Wang 2 , B. Cronquist 2 , R. Koga\ S. Penzin 3 , and G. Swift 4 

I . NASA Goddard Space Flight Center, Greenbeit, MD 2077 1 

2. Actel Corporation, Sunnyvale, CA 94086 

3. The Aerospace Corporation, LA, California 90009 

4. Jet Propulsion Laboratory, California Institute of Technology, Pasadena, CA 91 109 


Abstract 

Manufacturers of Field programmable gate arrays 
(FPGAs) take different technological and architectural 
approaches that directly affect radiation performance. Similar 
technological and architectural features are used in related 
technologies such as programmable substrates and quick-turn 
application specific integrated circuits (ASICs). After 
analyzing current technologies and architectures and their 
radiation-effects implications, this paper includes extensive 
test data quantifying various devices* total dose and single 
event susceptibilities, including performance degradation 
effects and temporary or permanent re-configuration faults. 
Test results will concentrate on recent technologies being used 
in space flight electronic systems and those being developed 
for use in the near term. 

This paper will provide the first extensive study of 
various configuration memories used in programmable 
devices. Radiation performance limits and their impacts will 
be discussed for each design. In addition, the interplay 
between device scaling, process, bias voltage, design, and 
architecture will be explored. Lastly, areas of ongoing 
research will be discussed. 

L Introduction 

FPGAs are becoming increasingly popular with 
spacecraft electronic designers as they fill a critical niche 
between discrete logic devices and expensive, long-lead time 
mask programmed gate arrays. The devices are inherently 
flexible to meet multiple requirements and offers significant 
cost and schedule advantages. Architecturally, the choice of 
type of storage for the configuration information drives 
radiation performance as in the commercial/military world it 
drives key functional features and performance. Radiation 
performance is influenced by other architectural features also, 
including such desirable features as programmable output 
slew rate, input delay selection, increased I/O module 
functionality, tri-state busses, global controls, etc. The 
granularity choices and details of the specific implementation 
of logic functions are also important. Additionally, the choice 
of fabrication technology affects total dose and single event 
latchup performance while determining die size, operating 
speeds, and power dissipation. The diversity of FPGA 
technologies and architectures make evaluating the radiation 
effects complex at both the device and system level. 

The flexibility and advantages of FPGAs are being 
applied to other electronic devices. For instance, a 
programmable routing network can be used to create quick- 


turn Multi-Chip Module (MCM) substrates; fully fabricated 
routing networks can be used to implement quick-turn ASICs 
where the FPGA programming resources are replaced by a 
simple single mask etch. 

This paper will analyze and present radiation data on the 
radiation effects on current programmable technologies with 
an emphasis on the most recent technologies. The analysis 
will discuss the effects and complex interaction of FPGA 
architecture, design, process, scaling, voltage and circuit 
design. Tables provide a quick reference to the performance 
of modem programmable technologies. A listing of the 
devices and their manufacturers is included in Appendix I. 

n. Device Categories 

FPGAs have 2,000 to 20,000 (or more) gates and fit 
between the PAL/PLA’s and the mask programmable gate 
arrays. Performance is moderately good, and they are 
extremely flexible as most logic structures may be easily 
implemented and are also user programmable. Like most 
standard commercial or military devices, radiation 
performance is a matter of luck since only one device series, 
the RH1280 and the RH1020, is currently intentionally 
radiation-hardened for total dose. This series was derived 
from ActePs commercial products, the A1280XL and the 
A1020B with modifications to the antifuses and isolation 
transistors to enhance radiation performance. Recently, Chip 
Express has introduced a new type of device between FPGAs 
and mask programmable ASICs. This is based on laser cutting 
of metal interconnects in the laser programmable gate array 
(LPGA) or by a one-mask etch. Both of these operations are 
done quickly at the factory and do not require that die and 
wafers be processed at the foundry. By building only a 
routing network constructed with metal routing structures and 
metal to metal amorphous silicon antifuses, Pico Systems has 
developed a quick turn MCM capability. Another 
programmable logic device is the PROM; currently these are 
implemented using either polysilicon or nichrome fuses or 
antifuses; Lockheed -Mart in’s device uses an Actel ONO 
anti fuse design and UTMC’s uses an amorphous silicon 
antifuse. While PROMs will not be directly addressed in this 
paper, their antifuse structures will be. PALs also are 
designed with a variety of configuration elements. Of 
particular interest to the spaceflight community is the UTMC 
UT22VPI0; this radiation-hardened device is built with a 
metal to metal amorphous silicon antifuse. These 
technologies all contribute to the quick design and build of 
small, low-cost, low- volume spaceflight electronic systems. 
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FPGAs can be divided into two broad classes based on 
the configuration mechanism, either reconfigurable or one- 
time programmable. The configuration memory controls 
function, routing, features, timing, I/O drive, etc. The 

reconfigurable devices subdivide into volatile SRAM-based 
and non-volatile with EEPROM cells. A hybrid class also 
exists where EEPROM is used to store the configuration 
information and loaded into SRAM when reset. 
Reconfigurable devices may be partially reprogrammed while 
running in some instances, such as Atmefs AT6000 or Xilinx’ 
XC6200 series. The one-time programmable devices use 
antifuses; the antifuses are implemented in either amorphous 
silicon or an ONO structure. 

The class of circuits available to the user also 
differentiates FPGA implementations. These include: 
programmable output slew rates to control ground bounce, 
input delay selection to optimize for on-chip delays or t^ times 
at device input pipeline registers, simple I/O buffers vs. 
complex I/O cells with latches, flip-flops, multiplexors, etc., 
JTAG 1149.1 Test Access Port (TAP) controller and 
compliant I/O cells, internal tri-state busses vs. multiplexor- 
based solutions, on-chip oscillators, phase-lock loops in the 
I/O cells, internal RAM for user FIFOs, storage, and lookup 
tables (LUT), etc. Each manufacturer includes different 
features, variable within families optimized for different end 
uses, and the radiation effects of many of these architectures 
can be heavily dependent on the configuration technology, as 
discussed in the next section. 

It is worth noting that FPGAs have the usual commercial 
off the shelf (COTS)-related problems of constantly changing 
designs, processes, and foundries. Experimental results show 
that radiation performance can be quite sensitive to these 
changes. 

ID. Radiation Performance 

A. CONFIGURATION TECHNOLOGIES 

The configuration technology of a programmable device 
drives its architecture, performance, and features. For space- 
based application, it is also one of the key factors in a device’s 
radiation performance and is a major part of this study. 

/ ) Oxide Nitride Oxide ( ONO) Antifuses 

To date Actel makes one time programmable FPGAs with 
a dielectric antifuse (with the SRAM-based System 
Programmable Gate Array, ‘SPGA,’ having been announced). 
The basic construction of the Oxide-Nitride-Oxide (ONO) 
antifuse and its characteristics is shown in Figure I. The 
radiation characteristics of this antifuse have been extensively 
studied (1,2, 3]. While hard to TID, the high electric field 
strength across the antifuse (~ 6 MeV/cm) results in a 
susceptibility to heavy ion-induced failures of unprogrammed 
antifuses. Fortunately for spacecraft designers, rare heavy 
ions with normal LETs greater than 37 MeV-cm 2 /mg or V DD ’s 
greater than 5.5 volts are required for damage, making the 
probability of failure low. The RH 1 280 and the RH 1 020 have 
thicker antifuses, 99A and 96A respectively, which 


dramatically reduces the failure cross-section, but increases 
programming times. For example, an AI280A design which 
programs in -7 minutes takes - 55 minutes or more for an 
RH 1280. 


Polysilicon 



Figure 1: Actel ONO Antifuse 

The dielectric antifuse imposes some inherent constraints 
on radiation performance. First, the relatively high voltages 
required for programming limit the amount that the epitaxial 
layer may be thinned. While the Manassas rad-hard foundry 
builds SRAMs on 2 ^im epi that enhances SEU performance 
by reducing charge collection from a given ion, the RH1280 
and RH1020 are built on 5 p.m thick epi-layers. The 
RH1280’s heavy ion susceptibility is similar to A1280As on 
10 pm epi. Additionally, the higher voltage isolation 
transistors required hurt total dose performance leading to 
increased leakage currents, longer start times, and larger turn- 
on transients. Investigations into the turn-on transients 
implicate the limited current capability of the charge pump 
and its inability to rapidly charge the isolations transistors’ 
gates after total dose has increased their gate leakage [4]. 
When the bias voltage on the isolation transistors is 
insufficient, then the logic voltages reaching logic module 
inputs will bias both n and p-channel transistors of the CMOS 
pair and significant totem pole currents will result, creating the 
transient. An additional effect is the operation of the I/O logic 
during power-up. Using a simple implementation model, it is 
easy to see that the I/O modules will have garbage in and will 
put garbage out. This characteristic can cause the device to 
take significant time to meet its truth table and for particular 
mission-critical situations may be unacceptable. Controlling 
I/O modules during power up can be relatively straightforward 
with a slight change in the device architecture. 

2 ) Amorphous Silicon Metal-to-Metal ( M2M) Antifuses 

Amorphous silicon antifuses hold performance 
advantages over the dielectric version; programmed resistance 
is -25-50 ohms versus -300-500 ohms for FPGAs. For the 
programmable substrate where density is not as critical, the 
programmed resistance is less than 1 ohm. Figure 2 shows a 
version of a metal to metal amorphous silicon antifuse used as 
our technology development vehicle. Figure 3 shows a cross- 
section of the Quicklogic design (5). With a three layer metal 
process, the antifuse can be built between layers 2 and 3 on 
top of the logic device and not in a channel; this drastically 
cuts die size and improves speed. The amorphous silicon 
antifuses are quite a bit thicker than the ONO structures; they 
range from 500A (Pico Systems) to -1000A (Quicklogic). 
From a radiation perspective, amorphous silicon antifuse- 
based devices hold significant advantages - their lower 
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programming voltages permit thin 2 jini epi-layers to be used 
for maximum Single Event Upset (SEU) performance. 



Metal - 3 Top 


Amorphous Silicon 


Dielectric 


Metal - 2 Bottom 


Figure 2: Actel a-Silicon Antifuse ‘Pancake' 
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Figure 3: Quicklogic a-Silicon Antifuse 

Amorphous silicon devices have been radiation tested. 
No problems have been observed as a function of total dose 
under proton exposure. However, heavy ion irradiation did 
show damage to one technology development FPGA at a 
nominal bias voltage of 3.3 VDC. Using a different antifuse 
material and process, a metal to metal antifuse passed heavy 
ion irradiation up to a Linear Energy Transfer (LET) of 59 
MeV-cm 2 /mg at a bias voltage of 4.0 VDC. The bias voltage 
for failure of this 3.3 VDC structure was not reached. Our test 
pattern for the amorphous silicon antifuse in the 
programmable substrate consisted of two arrays of biased 
antifuses. Room temperature leakage at normal operating 
voltages (12VDC max) is low; under irradiation, most failed 
antifuses reached our programmed current limit of 20 mA 
while one was observed to be partially programmed. 

3 ) Antifuse Radiation Effects 

The RH1280 and the RH1020, as mentioned above, have 
thicker antifuses than their commercial/military cousins. The 
increased voltage margin for rupture can be seen in Figure 4, 
where positive voltage margin is shown for ions with an LET 
less than 37 MeV-cm 2 /mg. Figure 5 summarizes these 
antifuses’ performance as a function of electric field strength. 
One important result is the two points shown for the RHI020 
(prototype) at an LET of 37 MeV-cm 2 /mg. Here, a single 
antifuse broke at a substantially lower voltage than any of the 



other ones. This shows the need for a careful and thorough 
screening/stress test for antifuses and tight process controls for 
maximum performance. Tighter screening was applied to the 
Pico Systems programmable substrate for the unit tested at an 
LET of 27 MeV-cm2/mg and may account for the bend in this 
devices’ line. As these procedures are being developed to 
improve performance, tests showed the more thorough 
screening increased the variability of antifuse rupture 
threshold; only some of the ‘weak sisters’ have been 
eliminated in the Pico Systems’ devices. 



Figure 4: Antifuse Breakdown Voltage vs. LET (MeV-cm 2 /mg) 
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Figure 5: Antifuse Breakdown E-Field Strength vs. LET(MeV- 
cm 2 /mg) 

Along with an improved voltage margin, the thick ONO 
antifuses provide a decreased failure cross-section. For an 
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Iodine irradiation (LET-60 MeV-cm 2 /mg) at V cc - 5.5 VDC 
and using Ice as a figure of merit (a good first order 
approximation), it is seen that the RH series of devices have 
superior performance to that of the thinner commercial/ 
military parts. Figure 6 shows a current strip chart for an 
AI280A, an RH1020 prototype, and an RHI280. 

We used two different technology development metal-to- 
metal amorphous silicon antifuses designed for 3.3 VDC 
FPGA applications; each of these antifuses used a different 
material and recipe. One antifuse (MKJ911) had positive 
margin at 4.0 volts which exceeded the maximum 
specification of 3.6 VDC for the part while irradiated with 
Iodine (LET - 60 MeV-cm 2 /mg) at normal incidence. 
Another device, the KJ91 1, immediately failed at a 3.3 VDC 
bias voltage with the current quickly ramping up over 300 
mA; normal dynamic current is less than 10 mA for this 
device at room temperature. 



Figure 6: I C c as Function of Iodine Ion Fluence for Devices with 
Antifuses of Varying Thickness. 


For the different types of antifuses, different analysis 
techniques are required. Using strictly electrical 
measurements, the differential Iddq technique has been 
previously described [3]. Unfortunately, our technology 
development devices and programmable substrates did not 
permit this technique to be applied for the initial stage of the 
investigation. It has been found that biased, damaged ONO 
antifuses can be detected by using emission microscopy; this 
permits isolation of failed structures down to a resolution of 
approximately 1 [im. Unfortunately, the damaged metal-to- 
metal antifuses were not detectable with this technique. We 
have had initial successes for both the technology 
development FPGA and the programmable substrate by using 
the liquid crystal technique; this utilizes the heat generating 
property of a damaged, biased, antifuse. Electrical testing of 
failed amorphous silicon and ONO antifuses had differing 
current-voltage 'signatures/ Details and failure analysis 
photographs will be included in a future paper. 

Attempts to measure the heavy ion radiation hardness of 
the Quicklogic amorphous silicon antifuse failed; the device 
quickly latched up. The UTMC amorphous silicon PAL 


(UT22VPI0) has been tested by several groups with no 
antifuse problems reported [6]; a specialized test for this 
device along with structures is planned in conjunction with 
UTMC engineers. 

EEPROM configuration memories are also used in certain 
FPGAs in conjunction with pass transistors. The performance 
of EEPROM cells has been characterized previously and it has 
been shown that there is a susceptibility to heavy ions during a 
write cycle, when the electric field during the high voltage 
operation is strong. For EEPROM devices, the internal 
architecture must be closely examined as some devices upload 
the non-volatile memory into SRAM-pass transistor elements 
for configurations. For devices of this class, the radiation 
characteristics of SRAM-based FPGAs will also apply. 

4 ) SRAM -Based Devices 

SRAM-based devices such as those from Xilinx, Atmel, 
Lucent, NSC, Altera, etc., offer the most flexibility, as in- 
system/on-orbit programmability is possible. Additionally, 
this class of devices offers the most power for reconfigurable 
computing platforms, flexibility for changing requirements, 
and potentially even correction of logic errors and recovery of 
in-flight failures. Testability and verification of these features 
is outside the scope of this paper. Along with the power of 
SRAM-based devices, the radiation effects and impacts are the 
most complex. 

Like the antifuse and EEPROM-based components, it is 
critical that the configuration information remains valid. 
Invalid configurations may result in incorrect operation of the 
device and damage to either the FPGA itself or system 
resources. It has been demonstrated that loading an incorrect 
configuration into a Xilinx SRAM-based FPGA can destroy 
the device, and this may apply to other manufacturers. System 
resources may be damaged by loss of control of tri-state 
busses or by initiating critical system events. Logic can be 
included on the system board to check the configuration of the 
FPGA. This can be done by either by reading out its contents 
or by having the FPGA compute a checksum of its contents 
and comparing it to a calculated value held in a trusted 
register. Study shows that verifying the state of the FPGA at 
10 m sec intervals looks feasible, although that may not be fast 
enough to prevent these deleterious effects for critical 
applications. 

As a base technology, SRAM configuration memories 
have significant advantages over other technologies. 
However, there are significant architectural disadvantages. It 
is not possible to utilize structures such as Triple Modular 
Redundancy (TMR) or Hamming codes for existing devices to 
mitigate SEU’s, as can be done with FPGA user memory. 
Additionally, quite a large number of cells need to be made 
SEU-hard. Table I shows the number of configuration 
memory elements required for different FPGA architectures, 
with 10,000 “usable gate array gates** as the standard size. 
Note that for FPGA architectures with limited routing 
resources, the number of usable gates can vary dramatically. 
While it is noted that the antifuse based device does have 
configuration memory bits (for programming and testing 
applications) they are held in reset via an external pin so they 
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don’t contribute to the radiation sensitivity of the device. The 
amount of silicon required for configuration memory for 
SRAM-based FPGAs is similar in principle to a moderately 
large sized radiation-hardened SRAM. In addition to the 
storage, pass transistors, routing resources, logic needs to be 
implemented on the die. The sheer number of configuration 
bits, relative to the number of user storage elements, directly 
increases the cross-section of the device by roughly two orders 
of magnitude. 


Table I. SRAM Configuration Memory Sizes 
FPGA Configuration Memory (Bits) 


AT6010 

131,000 

XC4020 

329,000 

XC6216 

173,000 

2C26 

274,000 


The effects of an upset in an SRAM-based FPGA strongly 
depend on the technology, architectural features, and system 
design. For instance, a SEU may cause two output drivers 
internal to the chip to be connected, resulting in an 
unintentional high-current state which may exceed current 
density requirements for reliable operation. Other problems 
may be bus fights on internal tri-state busses leading to 
overstress, isolation of pull-up resistors on tri-state busses 
resulting in floating inputs and oscillations, changing of output 
slew rates resulting in system timing failures, change of input 
delays resulting in timing failures or metastable states, turning 
input modules into an output configuration, leading to 
overstress or failure of the FPGA and/or other components on 
the board, logic failures resulting in failure of the system 
board causing either a detected safe-hold and reconfiguration 
or permanent damage or state change if used in critical 
circuits, etc. 



Figure 7: RHI280 Antifuse Rupture ‘Signature’ 


Heavy ion testing of Xilinx, Lucent, and Atmel SRAM- 
based FPGAs show configuration memory upsets with an 
extremely low upset LET threshold of approximately 4-5 
MeV-cm 2 /mg. Additionally, some devices are upset in 
configuration memory with 200 MeV protons. Also observed 
were step increases in supply currents similar, but larger than 
those seen with antifuse failure in ONO antifuse based 
FPGAs. The extra current could be removed by reconfiguring 
the device, without a power reset, with the most probable 
cause being an internal driver fight, as seen in antifuse 
FPGAs. Figures 7 shows an T cc strip chart during heavy ion 
irradiation of an ONO antifuse-based device (RH1280) with 
an SRAM-based device showing a similar signature, most 
likely a similar effect of a short in the routing structure. 
Figure 8 shows that a cross-section vs. LET curve can be 
constructed for the configuration memory elements for Single 
Event Reprogramming (SER). This particular curve serves as 
a lower bound for the device; a ‘failure’ was detected by 
functional failure of a simple shift-register circuit where 
functionality can be immune to a large number of 
configuration upsets. Future instrumentation of this class of 
devices will directly verify the configuration memory’s 
contents, providing increased accuracy in the measurement. 



LET (MeV-cm 2 /mg) 

Figure 8: Single Event Reprogramming for SRAM FPGA 
5 ) Quick-Turn ASICS 

Quick turn ASICs are immune to configuration memory 
errors as their configuration is ‘programmed’ with metal. 

B . FABRICATION CONSIDERATIONS 

A variety of basic technologies is utilized for the 
fabrication of FPGAs. Commercial FPGAs are made from 
both bulk and epitaxial silicon CMOS processes. An 
interesting device under development (US Air Force) is a re- 
programmable GaAs-based FPGA. Two methods are in 
general use for making user-accessible storage elements: 
dedicated flip-flops and latches which have low impedance 
feedback connections and storage elements constructed from 
logic gates (i.e., multiplexors with feedback) which utilize the 
routing array for feedback connections. 
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/ ) Latchup Susceptibility and Analysis 

Bulk CMOS FPGAs from Quicklogic, Atmel, Lucent, 
GateField, and Xilinx show low latchup thresholds that are 
summarized in Table 2. However, the Chip Express QYH580, 
which is a bulk device, performed well with regards to 
latchup. It has a threshold of - 60 MeV-cm 2 /mg at V DD - 
5.5VDC; at V DD - 3.6 VDC no latchup was detected up to an 
LET of 74 MeV-cm 2 /mg. The results for this device are 
shown in Figure 9. 



Table 2. Summary of FPGA Latchup Performance 


Latched 

Threshold 

Not Latched 

AI020B/TI 

-22 

RH1020 

A1020B/MEC 

27-37 

AI280XL 

A32200DX 

11-16 

A32I40DX 

AT6002 

-11 

1460 A, 1 4100 A 

QYH580 (5.5) 

-60 

QYH580 (3.6) 

CX2041 (5.5) 

-22 

CL Ay- 3 1 

GF10009K 

<12 

KJ9 1 1 

2C40 

<7.8 

MKJ91 1 

pASIC 1 

«60 


XC3090 

4-7 



Epitaxial CMOS devices performed better, most showing 
no sign of latchup, although as previously seen in memory 
chips and processors, epi is no guarantee of latchup- 
immunity. Shrinking feature sizes can make a device more 
latchup susceptible as seen in Matsushita Electric Company 
(MEC) foundry AI020’s on 10 pun epi. 1.0 pm A1020B’s 
latched at an LETjh of - 55 MeV-cm 2 /mg, although the 2.0 
pm A 1 020 and the 1 .2 pm A1020A did not latch to an LET of 
greater than 120. Neither the MEC 1.0 pm A1280A’s nor 1.2 
pm AI280’s latched and were designed with different design 
rules. Also, the foundry can make a critical difference as seen 
from comparing 1.0 pm A1020B’s from MEC and TI, along 
with a 1.0 pm RH1020 prototype, tested under identical 
conditions. The RH1020 would not latch, the MEC A1020B 


latched with a small cross-section, and the TI A1020B latched 
with a cross-section greater than an order or magnitude larger 
than the MEC device. Additional testing showed that the TI 
produced devices had a latchup threshold of - 22 MeV- 
cm 2 /mg. Further tests showed that recently produced MEC 
AI020B’s had a latchup threshold between 27 and 37 MeV- 
cm 2 /mg, considerably less than the devices tested three years 
earlier. MEC and TI 1.0 pm A1020B’s were subjected to 
destructive physical analysis (DFA) and showed near identical 
epi-layer thickness, with the MEC part having a 9 pm epi- 
layer and the TI device having the nominal 10 pm layer. 

Another example of epi parts latching is shown in Figure 
10 for the new A3200DX family, which is derived from the 
familiar Act 2 devices and are produced on a 0.6 pm epitaxial 
process from the Chartered foundry. Two lots of A32200DX 
were tested and both lots readily latched. However, its sister 
part, the A32140DX did not latch at all. Destructive physical 
analysis was performed on the latched parts and showed good 
epi-layer thickness, between 8.5 and 9.0 pm, within 
specification. The major architectural difference between the 
A32200DX and the A32140DX is on-chip SRAM in the 
A32200DX; a detailed examination of this area of the chip 
showed a lack of guard rings, which contribute to the chip’s 
latchup sensitivity. 



2 ) Total Dose Capability and Analysis 

Many of the FPGA companies are ‘fabless’ and some 
have multiple sources for their devices. As seen above with 
respect to latchup, similar dependencies have been observed 
for total dose. Several years ago the differences between TI 
and MEC parts for the A 1020 were measured, with the MEC 
parts able to survive greater than 100 krads (Si) and the 
capability of the TI devices were less than 10 krads (Si). 
Recently, testing has been conducted with the newer Act 3 
devices, the A1460A, and the A14100A. Here, parts from 
MEC have been able to withstand between 15 and 50 krads 
(Si), depending on the lot, and die produced at Chartered 
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failed at approximately 4 krads (Si) or less. Sample data is 
shown in Figure 1 1 . 

Additionally, manufacturers continually update their 
designs and continue to shrink the process used for 
fabrication, sometimes concurrently, making it difficult to 
separate the causes of changing radiation characteristics. For 
instance, the 1.2 and 1.0 pm A 1 280(A) devices have migrated 
to the A1280XL family, fabricated in 0.8 and 0.6 pm feature 
sizes, with production moved to Winbond and Chartered. 
While AI280A devices are typically ‘good* (I C c less than 6 
mA) to approximately 6-7 krads (Si), TID testing showed 
inferior performance of the XL series devices, with a 
capability of 4 krads (Si) or less. Figure 12 shows the 
performance of the A1280XL with 196 MeV protons; these 
devices failed at less than 3 krads (Si). 



Figure 1 1: TID Performance as a Function of Foundry 



Figure 12: TID Performance of A1280XL Series 

The newer 0.6 pm Chartered produced A32I40DX had a 
total dose capability of approximately 2.2 krads (Si). The data 
is shown in Figure 13. However, a 0.6 pm technology 


development device has shown a total dose capability of 
between 30 and 50 krads (Si), fabricated at MEC One lot’s 
performance was characterized with protons and another lot in 
the NASA/GSFC Cobalt-60 facility (Figure 14, the MKJ9I I 
device). Also shown in Figure 14 is a technology 
development vehicle processed at Lockheed-Martin (KJ91 I); 
testing was completed until the dose reached 200 krads (Si), 
with no observed parametric changes in I cc and the part 
passed functional tests. 



Figure 13: A32I40DX (Chartered) TID Performance 
Observed total dose performance is summarized in Table 3. 


Table 3. Recent TID Measurements 


Device 

Size (Foundry) 

kRads (Si) 

A 1280 A 

1.0 pm (MEC) 

~7 

A1280XL 

0.8 pm (WIN) 

<3 

RH 1 280 

0.8 (im (L-M) 

>300 

AI280XL 

0.6 >un (CH) 

<3 

Act 3 

0.8 pm (MEC) 

15-50+ 

Act 3 

0.8 pm (WIN) 

^<5 

A32I40DX 

0.6 pm (CH) 

< 3 

MKJ911 

0.6 pm (MEC) 

30-50 

KJ911 

0.6 pm (L-M) 

>200 

QYH580 

0.8 pm (Yamaha) 

~I5 

CX204I 

0.6 pm (Tower) 

-7-10 


Several studies were performed to determine the affect of 
design and process on total dose capability of commercial 
parts and gain additional insight into the devices’ total dose 
limitation. These studies are continuing and will be reported 
in a future paper. 

3 ) Proton Susceptibility and Analysis 

For many low earth orbiting satellites, sensitivity to 
protons is a major system design issue. Table 4 summarizes 
measured and expected proton results. It appears that device 
scaling is a major indicator of proton susceptibility, with most 
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devices less than 1.0 pm in feature size being susceptible to 
proton upset. For example, the AI280A (1.0 pm, TI and 
MEC) would not upset for 200 MeV protons; the 0.8 and 0.6 
pm A1280XL\s as well as 0.8 pm Act 3 devices would upset 
(for hard-wired flip-flops). Additionally, it should be noted 
that an upset was observed in the Act 3 I/O flip-flop. 



Figure 14: I cc vs. Dose for Two 0.6 pm Development Parts. 


Table 4. Summary of 196 MeV Proton Tests 


Proton SEU Susceptibility 

Upset 

No Upset 

A1280XL (0.6, 0.8) 

A1280XL C, I/O 

RH 1280 S (0.8) 

RH1280 C, I/O 

Act 3 S, I/O (0.8 pm) 

A 1280 (1.2 pm) 

CL Ay-31 (0.8 pm) 

A1280A (1.0 pm) 

AT6002 (data)(0.8 pm) 

Act 3 C 


MKJ9I1 (0.6 pm) 


However, feature size is just one contributing factor. As 
seen in Table 4, a 0.6 pm device used for technology 
development, the MKJ91 1 saw no proton upsets, with the 
hard-wired flip-flops corresponding to S-Modules biased at 
only 3.3 VDC. Further analysis shows that flip-flop design 
and construction directly affect the SEU performance. Over a 
variety of technologies, ‘hard-wired’ flip-flops have shown 
LET thresholds between 4 and 10 MeV-cm 2 /mg; those 
constructed from logic gates have been measured to have 
thresholds of approximately 15-25 MeV-cm 2 /mg. Hard-wired 
flip-flops are constructed with metal connections at device 
fabrication time; those constructed from gates differ in that the 
feedback signals propagate through the routing network where 
routing tracks have relatively high capacitances. These 
numbers have held relatively constant, even for designs that 
have been scaled from 2.0 pm down to 1.0 pm, such as the 
MEC A 1020 series. For many devices, a strong relationship 
has been noted between stored state and flip-flop sensitivity. 


Analysis has shown that this is a design that has been 
optimized for commercial, non-radiation-hardened 
applications. Prototype devices with circuit designs more 
amenable to space flight applications have shown dramatic 
improvements in SEU performance. As shown in Figure 15, 
the performance of the A1280A varies widely, depending on 
stored state; these curves are for a V cc - 5.0VDC. The TD 
device, operating at V C c * 3.0VDC, has superior performance 
to the “non-balanced” version. A similar effect can be seen 
with a ‘routed* flip-flop design. Figure 16 shows A1280A 
performance and the effect of state; also plotted is the 
QYH580 that is constructed with connections going through 
the routing network in the channeled architecture and the flip- 
flop is a balanced, symmetrical design. Here, the 0.8 pm 
QYH580 performance matches the 'best case’ performance of 
the 1 .0 pm A 1 280A. 




LET (MeV-cm 2 /mg) 

Figure 16: SEU Perf. vs. F-F Design for Routed F-F's 
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Several other factors influence flip-flop performance. 
Our technology development vehicle was fabricated both on 

10 Jim and 2 \im epi substrates. While initial simulations 
indicated that there would be little to no gain at a V cc of 3.0 
VDC, performance measurements showed a consistent benefit 
to the 2 Jim epi device. Another factor is the trend to lower 
supply voltages. As the density and operating speed of 
devices continues to increase, power dissipation will become a 
limiting factor for many designs. Consequently, designers are 
moving to lower voltages, typically V cc - 3.3VDC since 
power is a function of the square of the operating voltage. 
Figure 17 shows the SEU performance change for the 
QYH580. Note for this device, the SEU threshold is still 
approximately 28 MeV-cm 2 /mg at V cc -3.3 volts, acceptable 
for many applications without having to resort to techniques 
such as triple modular redundancy (TMR) [1,7]. 
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LET (MeV-cm 2 /mg) 

Figure 17: SEU Performance vs. V cc For the QYH580 



4) Logic Upset 

Logic upset is defined as a transient pulse from a single 
ion strike. This can occur in combinational circuits or the 

output of a flip-flop that doesn’t change state (which would 
make it an SEU). Logic upset has been observed in some 

FPGAs. This includes clock upset in the 2.0 |xm A 1020 at 

standard operating voltages and gate hits in the RH1280 when 

running at a supply voltage of 3.3 VDC ± 10%. The future 
direction of FPGAs is towards lower supply voltages that are 
required by the advanced 0.35 and 0.25 pm processes in the 
commercial world. Xilinx commercial product plans, for 
instance, call for core logic voltages falling below the 3.3 
VDC level, dropping to 2.5 VDC [8]. While necessary from a 
processing point of view, system designers will insist on lower 
voltages. With higher operating frequencies and gate counts, 
reducing the operating voltage is critical since the power is a 
function of the square of the voltage and a linear function of 
frequency. To date, detecting logic upset has relied on 
cumbersome techniques such as monitoring clock frequency. 


observing changes in SEU rate as a function of frequency (to 
catch glitches), etc. Recently, new on-chip circuits have been 
designed to directly detect logic upset since bringing a small 
‘glitch’ off-chip will be difficult since it can be filtered by the 
output stage. Since storage is required for this measurement, 
self-relative techniques are used to cancel out the SEU rate of 
the monitors. 

C. ARCHITECTURAL FEATURES 

Architectural features factor into the radiation 
susceptibility of FPGAs. For instance, power-on reset circuits 
may be upset and alter the state of a reconfigurable device. 
This has been observed in radiation-hardened PALs (by 
Boeing) with the function of the reset in the 22V 10 
architecture resulting in all flip-flops being cleared [6]. 
Obviously, this has serious implications for SRAM-based gate 
arrays used in critical applications. At the circuit level, the 
state of the device can be altered such that the reloading 
sequence needs to be repeated; other effects include altering 
the function and structure of the device which is discussed 
below. Error monitoring circuits may be needed to ensure 
adequate system reliability by constantly monitoring the 
configuration; these trusted circuits will obviously consume 
valuable board space unless provision is made for including 
radiation-hardened monitors on the FPGA device. This may 
be preferable to SEU-hardening 150,000 or more 
configuration bits for some applications. The architecture of 
the device and system design also affects these error-checking 
operations. For instance, some devices contain a mode where 
‘reading’ the configuration bits produces a checksum. This 
mode will be useful for FPGAs that are loaded from a remote 
processor where constantly shipping the PROM contents will 
consume excessive processor and I/O bandwith. Another 
approach would be for the trusted monitor to ‘listen’ as the 
FPGA device is being loaded, read out the FPGA’s 
configuration bits, compute the checksum locally, and then 
compare it to the checksum of the loaded pattern. Note that 
for FPGAs that are configured in a daisy-chain manner, which 
simplifies external I/O, the situation is a bit more complicated. 
Lastly, in the event that an FPGA needs to be reloaded in a 
critical system , erroneous outputs need to be blocked to not 
have a negative system impact and the system must be 
restarted. This would require that all outputs be delayed by 
trusted circuits by the amount of time necessary to verify the 
FPGA’s configuration and then replace the FPGAs outputs 
with ‘safe’ values in the event of a fault. Obviously, this 
complicates gate array logic design as well as system design 
and operations. 

At the circuit level, there are strong impacts from an SEU 
in the configuration memories of SRAM-based FPGAs. For 
some examples, the I/O cell of a popular SRAM-based FPGA 
(XC4000) is reproduced in Figure 18 (9). Key functional 
attributes of the device are controlled by SRAM. These 
include pull-up and pull-down resistors, input threshold, input 
and output clock polarities, input delay, output polarity, 
whether I/O is pass-through or registered, and whether the cell 
is an input or an output. System level effects can range from a 
slight power increase (e.g., enabling a pull-up resistor) to 


Page 9 of 12 



PREPRINT - IEEE TNS/NSREC 1997 


intermittent operation (e.g., changing input delay), to incorrect 
results (e.g., changing output polarity), to system damage 
(e.g., enabling a tri-state buffer for a cell that is required to 
serve as a high-impedance input). Internally to the device, for 
some architectures, configuration SRAM upsets can result in 
driver fights in the routing network, bus fights on tri-state 
busses, floating busses if a pull-up resistor is disconnected, 
etc. These SEU’s can potentially result in compromising the 
reliability of the hardware from device overstress. 



Figure 18: XC4000 Series I/O Block 

For the first several generations of FPGAs, there has been 
a trend to both increase the number of I/O pins and the 
functionality and performance of the I/O modules. For 
example, the popular Act 1 family had an I/O module that 
consisted simply of an input buffer and a tri-state output. For 
Act 2 two latches were added and they had moderate SEU 
hardness with an LET th of ~ 25 MeV-cm 2 /mg. Higher circuit 
performance and functionality was realized in the Act 3 I/O 
module. This was a result of the two registers that permit 
higher speed pin-to-pin operation. It also results in a larger 
I/O module and as a result, the p-channel feedback transistor 
in the flip-flop structure in this commercial/military design 
was minimized. This results in a SEU LET th of - 10 MeV- 
cm 2 /mg and susceptibility to proton upset. While the register- 
rich FPGAs easily permit TMR schemes to combat SEU’s, 
implementing this at the I/O module is prohibitively expensive 
since the basic rule in FPGA design are that gates are cheap 
and I/O pins are expensive. While FPGA manufacturers have 
addressed this issue with increasing I/O counts from -60 pins 
per chip to greater than 200, the scaling of logic cell density 
and the move from 8 and 16-bit systems to 32-bit systems 
keeps I/O pin usage at a premium. A radiation-hardened 
architecture would either harden the storage elements in the 
I/O cells or have architectures that feature 0 nS hold time for 
internal storage elements with respect to the device’s pins and 
fast clock to out for small off-chip delays. These parameters, 
in particular, are critical for PCI applications, which are 
becoming more prevalent in space-based designs. 

Recently, the XC6200 family was introduced for 
reconfigurable computing applications. An examination of the 
data sheet reveals some interesting architectural features for 
design engineers [101. However, the XC6200 has a register to 
globally control some device characteristics. One key 


function is a clock on/off bit with obvious implications for 
critical systems in the radiation environment. 

IEEE 1 149.1 JTAG (Joint Test Action Group) circuitry is 
included on recent FPGAs. This includes a state machine 
called the Test Access Port (TAP) controller to command the 
chip into either an operational or one of several test modes 
(i.e., controlling the direction and state of the I/O). This 
machine may be susceptible to SEU’s and are strongly 
suspected to have been detected during heavy ion testing. 
Some test modes, if not commanded at the board level since it 
is a system test, may damage the FPGA or other system 
devices as well as causing a loss of control. For example, the 
EXTEST command can configure all I/O pins as outputs, 
actively driving; the actual function of each pin is determined 
by a two-bit per pin shift register which is part of the test 
logic. 1 149.1 includes a provision for a hard reset for the TAP 
controller which could ensure that test modes are not entered; 
unfortunately, most FPGA manufacturers are not 
implementing this function. For antifuse devices, some 
models have the ability to hardwire the TAP controller into 
the reset state. Of course, this eliminates the testability 
features that will become more important as FPGAs are 
integrated into MCM and Chip On Board (COB) assemblies. 

IV. Flight Vs. Ground Data 

Programmable devices have been extensively studied in 
ground radiation facilities and are virtually ubiquitous on 
modern, space-flight circuit card assemblies. One part of our 
study is a board that was designed and built to fly on the 
Microelectronics/Photonics Test Bed (MPTB). See Figure 19 
for a simplified block diagram. This card will perform SEU, 
total dose, and antifuse rupture experiments. Total dose 
damage will be studied by monitoring the current to each 
device under test (DUT), including the control DUT. Also, 
shields of varying thickness’ and materials are used on a 
subset of the DUTs and a dosimeter is placed on the card. 
SEU’s will be monitored by examining the contents of the 
DUTs memory elements, configured as shift registers. S- 
Module, C-Module, and I/O-Module flip-flops are monitored. 
On board logic can generate several different test patterns or 
the chip may be placed into any arbitrary state by the system 
processor; note that this can be potentially used to perform in- 
flight I D dq measurements. The DUTs used for the SEU 
measurements are 5 A1460A’s (0.8 pm) produced at the MEC 
foundry. Three of the DUTs are connected to an in-flight 
programmable voltage rail that permits devices to be operated 
at either 3.3VDC or 5.0VDC. For an antifuse rupture 
experiment, a programmable bias generator and a fine current 
sensor are connected to an A1280A/KFUSE (1.0 pm). The 
double-sided board is shown in Figures 20 and 21. 

V. Conclusion 

FPGAs will become increasing critical in spacecraft 
electronics designs as the emphasis to decrease cost and 
mission development time continues. These same factors are 
also driving the use of other technologies such as 
programmable substrates and quick-turn ASICs. There is a 
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strong drive to utilize standard ( () I S/military devices in 
spaceflight systems to minimize cost and development time as 
compared with radial ion-hardened devices. This has serious 
impacts on the radiation and system performance for 
spaceflight systems. 



Figure 19: Block Diagram of MPTB Experiment 



Figure 20: Side A of the MPTB Experiment. 

While it is desirable to find trends such as those based on 
process scaling, no generalizations can be made. Instead, it is 
seen that there is a complex interplay of scaling vs. process vs. 
system voltage vs. architecture vs. circuit design. Many rules 
of thumb fail and detailed examination, analysis, and testing is 
required. New, modern architectural features that permit 
flexibility for commercial systems can have severe radiation 
implications. 'Phis can require additional system resources 
such as monitors, protection of circuits' outputs, and system 


restart/chcckpoinl capability along with risk of damage to the 
hardware or system from the new failure modes introduced. 
Many COPS structures arc extremely reliable for ground 
operations. However, many types of failures from radiation 
have been detected in structures such as configuration 
memories. ONO antifuses, and metal-to-metal anlifuses from 
several manufacturers. The susceptibility of the relatively 
thick. low electric field strength amorphous silicon antifuse 
was not expected and demonstrates the susceptibility of COTS 
structures in the radiation environment. Additionally, 
improvements in antifuse reliability were made: the ONO 
antifuse in the RH1020 and RHI 280 is improved and one 
metal-to-metal antifuse has so far demonstrated immunity to 
damage from heavy ions. It has been identified that the 
screening/stress procedures for anti fuse test are critical for 
eliminating the weak sisters and ensuring adequate reliability. 
‘Qualification by similarity' must be approached with caution 
as the introduction of a single architectural feature has been 
seen to inject a major radiation hazard. Examples have been 
seen where identical devices produced at different foundries 
have widely different radiation characteristics. Lastly, the 
architectures, structures, circuits, designs, scaling, and 
processes are constantly changing: test methods and 

equipment must be updated as well to accurately measure the 
radiation affects on these devices. 



Figure 21: Side B of the MPTB Experiment. 


Page 1 1 ot 12 















PREPRINT - IEEE TNS/NSREC 1997 


VI. References 

[1] R. Katz, R. Barto, P. McKerracher, B. Carkhuff, and R. 
Koga, “SEU Hardening of FPGAs for Space Applications 
and Device Characterization/’ IEEE Transactions on 
Nuclear Science, Dec., 1994. 

[2] R. Katz, R. Barto, and G. Swift, “Anti-fuse/FPGA 
Reliability in the Heavy Ion Environment,” NASA Tech 
Briefs, 1995. 

[3] R. Katz and G. Swift, “Diagnosis of Multiple Faults 
Using Iddq Techniques,” International Test Conference 
I ddq Workshop, 1995. 

[4] R. Katz and G. Swift, “Total Dose Response of Actel 
1020B and 2080A Field Programmable Gata Arrays,” 
RADEC’s, 1995. 

[5] Quicklogic, “pASIC 2 FPGA Family White Paper,” http:// 
www.quicklogic.com/techinfo/whitppr/whitppr.htm. 

[6] J. Wert, “UTMC UT22VP10 PAL Single Event Effects 
Test Report,” 9-5574-WEW95-139, Boeing Defense and 
Space Group, June, 1 996. 

[7] Actel Corporation, “Design Techniques for Radiation- 
Hardened Field Programmable Gate Arrays, Rev. 1,” 
1996, Edited by K. Hayes and R. Katz. 

[8] Xilinx Corp., ‘The Future of FPGAs,” http://www.xilinx. 
com, 1997. 

[9] Xilinx Corp.. The Programmable Logic Data Book . 1994. 

[10] Xilinx Corp., “XC6200 Field Programmable Gate 
Arrays,” 1994. 

VII. Acknowledgements 


VIIL Appendix I 


Summary of Devices 


A 1020 

Actel 

FPGA 


A 1020 A 

Actel 

FPGA 


A1020B 

Actel 

FPGA 


RH1020 

Actel 

FPGA 


A1280A 

Actel 

FPGA 


RH1280 

Actel 

FPGA 


AI280XL 

Actel 

FPGA 


Act 3 

Actel 

FPGA 

A1460A, AI4I00A 

A3200DX 

Actel 

FPGA 

A32140DX, A32200DX 

AT6002 

Atmel 

FPGA 


AT6010 

Atmel 

FPGA 


QYH530 

Chip 

Express 

LPGA, 

One-Mask ASIC 

CX2041 

Chip 

Express 

LPGA, 

One-Mask ASIC 

GF10009K 

Gate Field 

FPGA 


2C26 

Lucent 

FPGA 


2C40 

Lucent 

FPGA 


CLAy-31 

National 

FPGA 


Custom 

Picosystems 

Programmable Substrate 

pASIC 1,2 

Quicklogic 

FPGA 


UT22VP10 

UTMC 

PAL 


XC3090 

Xilinx 

FPGA 


XC4000 

Xilinx 

FPGA 


XC6200 

Xilinx 

FPGA 


TD Vehicle 


MKJ9 11, KJ91 1 Technology 
Development 


The authors would like to express their appreciation to 
John Slonaker of Unisys Corporation and to Ali Feizi and 
Martha O’Bryan of Jackson and Tull, Chartered Engineers, for 
their outstanding work and contributions. 


Page 12 of 12 



